Update dependency SixLabors.ImageSharp to v4 [SECURITY] by renovate[bot] · Pull Request #142 · FactoryGameFan/FactorioTools

renovate · 2026-10-08T02:57:20Z

This PR contains the following updates:

Package	Change	Age	Confidence
SixLabors.ImageSharp	`3.1.12` → `4.1.2`

Security update - this deliberately bypassed the weekly schedule. Still read it. Advisory version ranges are frequently flat and over-broad, so npm audit being red is not by itself evidence that the proposed bump is the fix.

Release Notes

SixLabors/ImageSharp (SixLabors.ImageSharp)

`v4.1.2`

What's Changed

Harden codec and metadata input validation by @JimBobSquarePants in #3187
Fix TIFF decoding of legacy 8-bit color maps by @JimBobSquarePants in #3189

Full Changelog: SixLabors/ImageSharp@v4.1.1...v4.1.2

`v4.1.1`

What's Changed

Fix CCITT decompressor bounds checks and error handling by @JimBobSquarePants in #3176

Full Changelog: SixLabors/ImageSharp@v4.1.0...v4.1.1

`v4.1.0`

What's Changed

GIF: background handling & quantizer overflow fix by @JimBobSquarePants in #3133
Validate PBM max pixel value by @JimBobSquarePants in #3134
Add support for Apple CgBI PNG images by @Erik-White in #3136
Fix GIF transparency handling and dither by @JimBobSquarePants in #3143
Bump codecov/codecov-action from 6 to 7 by @dependabot[bot] in #3141
Add BlendWithCoverage overloads. Optimize Rgba32 compatible shuffling. by @JimBobSquarePants in #3150
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #3146
Bump actions/cache from 5 to 6 by @dependabot[bot] in #3149
Fix convolution sampling for bounds smaller than the kernel radius by @JimBobSquarePants in #3152
Enhance pixel formats and associated-alpha operations with optimizations by @JimBobSquarePants in #3154
Bump actions/setup-dotnet from 5 to 6 by @dependabot[bot] in #3155
Fix degeneracy check for resize transforms by @JimBobSquarePants in #3157
Improvements to Apple CgBI PNG handling by @Erik-White in #3137
Clone TIFF profiles into image metadata by @JimBobSquarePants in #3159
Add AOT compiler seeds for pixel formats and ICO, CUR, QOI codecs by @JimBobSquarePants in #3160
Normalize SIMD pipelines using TensorPrimitives_ by @JimBobSquarePants in #3161
Add ANI decoder support by @Poker-sang in #2899
Remove AntialiasThreshold from GraphicsOptions by @JimBobSquarePants in #3162
Add plus and extended pixel blend modes by @JimBobSquarePants in #3163
Fix 16-bit binary PBM sample byte order by @JimBobSquarePants in #3164
Make MemoryAllocator limits configurable and extensible by @JimBobSquarePants in #3165

New Contributors

@Erik-White made their first contribution in #3136

Full Changelog: SixLabors/ImageSharp@v4.0.0...v4.1.0

`v4.0.0`

What's Changed

Update to net8 by @stefannikolei in #2583
Handle dedup of local palette of 256 length - Main by @JimBobSquarePants in #2607
Replace custom Crc32 by @JimBobSquarePants in #2611
Sync 3.1 DrawImage fixes by @tocsoft in #2612
Fix handling gif encoding for global palettes - Main by @JimBobSquarePants in #2615
Bump actions/setup-dotnet from 3 to 4 by @dependabot[bot] in #2613
Adjusted the casing of the Webp format name by @jscarle in #2623
Fix Paeth Filter decode on platforms that do not support Ssse3 - Main by @JimBobSquarePants in #2620
Fix WebP animation speed bug by @marklagendijk in #2624
Promote PixelTypeInfo to Pixel by @stefannikolei in #2601
TGA: Treat 32 bit True Color images always as transparent by @brianpopow in #2643
Modernize and optimize pixel format operations across platforms. by @JimBobSquarePants in #2645
Cleanup SimdUtils by @JimBobSquarePants in #2654
Bump actions/cache from 3 to 4 by @dependabot[bot] in #2648
Bump codecov/codecov-action from 3 to 4 by @dependabot[bot] in #2657
Bump NuGet/setup-nuget from 1 to 2 by @dependabot[bot] in #2658
Add v3.1.x fixes #2673 and #2674 into main. by @JimBobSquarePants in #2675
Add fixes 2668, 2676, and 2677 to main by @JimBobSquarePants in #2678
Merge 2681 to v4 Main by @JimBobSquarePants in #2690
Add JPEG COM marker support by @RobertMut in #2641
Bump actions/upload-artifact from 3 to 4 by @dependabot[bot] in #2625
Only exit JPEG scan decoding after multiple EOF hits by @JimBobSquarePants in #2701
V4 Ensure VP8X alpha flag is updated correctly. by @JimBobSquarePants in #2703
Fix animated png handling (issue #2708) by @SpaceCheetah in #2710
Merge latest release from v3 by @JimBobSquarePants in #2720
Fix MacOS jobs by @antonfirsov in #2728
Fix async-over-sync issue in Image.DecodeAsync() by @kroymann in #2725
Fix overflow in MemoryAllocator.Create(options) by @antonfirsov in #2730
GifDecoder: Limit lzw bits to a maximum of 12 bits by @brianpopow in #2744
GifDecoder : Allow skipping bad metadata using identify by @JimBobSquarePants in #2749
Add ICO and CUR file decoder. by @frg2089 in #2579
v4 - Fix off-by-one error when centering a transform. by @JimBobSquarePants in #2761
v4 Fix 2758 by @JimBobSquarePants in #2764
Simplify Color Space Conversion APIs by @JimBobSquarePants in #2739
Webp: Fix Issue 2763 by @brianpopow in #2767
V4 Correctly break during Png decoding by @JimBobSquarePants in #2773
V4 : Fix filtering on PNG encode. by @JimBobSquarePants in #2778
Fix #2779 buffer overrun by @KirillAldashkin in #2780
Fix ImageMetadata docs typo by @lofcz in #2781
Add API for metadata conversion between formats. by @JimBobSquarePants in #2751
Tiff decoder: Fix issue 2679 by @brianpopow in #2789
Replace PngCrcChunkHandling by @JimBobSquarePants in #2786
Add tagname to debugger visualization for Exif- and Iptc-values, to facilitate easier debugging and discovery by @lassevk in #2787
V4 - Correctly handle transform spaces when building transform matrices. by @JimBobSquarePants in #2795
Allow decoding Tiff of different frame size. by @JimBobSquarePants in #2788
Add progressive JPEG encoder by @ardabada in #2740
Fix using dither in BmpEncoder when bit per pixel is <= 4 by @mistoll in #2819
Add QuadDistortion to ProjectiveTransformBuilder by @Socolin in #2748
WEBP : Use Correct Width With AlphaDecoder by @JimBobSquarePants in #2823
#2807 Add early return in InternalDetectFormat by @stefannikolei in #2835
V4 : Rewrite ChunkedMemoryStream by @JimBobSquarePants in #2838
cleanup projects and environment variables by @kasperk81 in #2812
Expose Convolution Api by @JimBobSquarePants in #2797
Normalize Animation Encoders by @JimBobSquarePants in #2842
Normalize Encoder Transparency Handling For Alpha Aware Image Formats by @JimBobSquarePants in #2844
Remove Unsafe usage from GifDecoderCore and optimize loops by @antonfirsov in #2851
Install libgdiplus on ubuntu by @stefannikolei in #2875
V4 : Decode Chunky Tile Rows Directly. by @JimBobSquarePants in #2879
Get the benchmarks working again. by @JimBobSquarePants in #2886
V4: Gracefully handle LZW overflows by @JimBobSquarePants in #2887
Refactor buffer allocation in Vp8BitWriter.cs to use Span instead of byte[] in WriteFrameHeader by @paulomorgado in #2905
Nested sub ifds parsing fix by @IldarKhayrutdinov in #2869
Fix #2907. BMP indexed palette parsed wrong by @zabulus in #2911
Undo horizontal prediction for each tile row in case of tiled tiff's by @brianpopow in #2878
V4 - Use BPP from Color Writer for Compressor by @JimBobSquarePants in #2916
Modernize JPEG Color Converters by @JimBobSquarePants in #2917
Color conversion with ICC profiles by @JimBobSquarePants in #1567
V4 : Fix GIF, PNG, and WEBP Edge Case Handling by @JimBobSquarePants in #2894
Improve JPEG Block8x8F Intrinsics for Vector128 paths. by @JimBobSquarePants in #2918
Do not attempt to decode iDAT chunks when image is fully decoded. by @JimBobSquarePants in #2926
Fix Code Coverage Tests by @JimBobSquarePants in #2928
Do not encode WEBP images exceeding max dimensions by @JimBobSquarePants in #2930
Enable colorimetric normalization of JPEG image data during decode by @JimBobSquarePants in #2922
Remove unneeded loop in IccClut by @stefannikolei in #2936
Fix Typo and Offset in BufferedReadStream by @stefannikolei in #2935
V4 : Remove ExifTagValue.InteroperabilityIndex by @JimBobSquarePants in #2938
Add ARM support to WEBP Utilities by @JimBobSquarePants in #2933
Add Full Support for JPEG Tiff PhotometricInterpretation.Separated by @JimBobSquarePants in #2937
V4 TIFF : Allow additional and undefined extra samples by @JimBobSquarePants in #2941
V4 Use EXIF byte order for EXIF encoded strings. by @JimBobSquarePants in #2943
Reduce the number of memory allocations in lossless WebP encoder by @SladeThe in #2940
GIF: Check for end of stream when reading comments. by @JimBobSquarePants in #2954
Enforce Explicit Types and Target Type new by @stefannikolei in #2951
Use Target Type new only when apparent by @stefannikolei in #2958
Update Subject EXIF metadata when transforming images. by @JimBobSquarePants in #2946
Convert CodeBase to collection Expressions by @stefannikolei in #2957
Handle hex parsing in Color with format support by @JimBobSquarePants in #2964
Do not store obsolete tRNS chunk data following processing. by @JimBobSquarePants in #2975
Update to license enforcing submodule by @JimBobSquarePants in #2981
Only set GIF canvas background when required. by @JimBobSquarePants in #2982
When decoding a compressed TIFF, truncate a too-long string instead of throwing an exception by @brianberns in #2986
Enforce ICC D50 PCS illuminant when converting colours between profiles by @waacton in #2987
v4 : Add Full Metadata Parsing for WEBP Animations by @JimBobSquarePants in #3001
V4: Prevent negative allocation attempt for huge TIFF files by @JimBobSquarePants in #3003
Fix detection of canonical sRGB profiles by @JimBobSquarePants in #3008
Fix off-by-one errors when transforming images. by @JimBobSquarePants in #3011
Throw UnknownImageFormatException for empty input by @JimBobSquarePants in #3020
Normalize WebP Chunk parsing. by @JimBobSquarePants in #3021
Add ARM hosted runners by @stefannikolei in #3018
Explicitly handle missing SOS marker. by @JimBobSquarePants in #3022
Add .NET10.0 as TFM by @stefannikolei in #3014
Fix decoding tiff image with BigEndian + 64 bit / pixel + associated alpha by @Socolin in #3032
Fix PixelColorType.YCbCr wrongly interpreted as grayscale in PngEncoder by @Socolin in #3034
Fix VP8X reserved bytes use Position += 3 instead of Write, causing 3-byte truncation in alpha WebP images by @jrlost in #3036
Apply ICC Profile / Color Conversion when decoding PNG by @Socolin in #3028
Make UnmanagedMemoryHandle members readonly and improve pool finalization tests by @JimBobSquarePants in #3040
Minor optimizations to Resize. by @JimBobSquarePants in #3044
Enhance XmpProfile to add XDocument normalization by @JimBobSquarePants in #3047
Add proper IptcProfile support in PNG by @JimBobSquarePants in #3048
Add ICC profile conversion support to WEBP by @JimBobSquarePants in #3051
feat: Add animation loop control to DrawImage with repeatCount parameter by @Yushu2606 in #2995
Allow ICC conversion for Uncompressed CIE Lab, CMYK and RGB TIFF by @JimBobSquarePants in #3054
Capture palette from Tiff when available. by @JimBobSquarePants in #3055
Bump codecov/codecov-action from 4 to 5 by @dependabot[bot] in #2840
Speed improvements to resize convolution (no vpermps w/ FMA) by @JimBobSquarePants in #2793
Undo #2025 by @antonfirsov in #3061
Bump actions/cache from 4 to 5 by @dependabot[bot] in #3059
Add row-stride overloads for memory APIs by @JimBobSquarePants in #3066
Bump actions/upload-artifact from 4 to 6 by @dependabot[bot] in #3058
Bump actions/setup-dotnet from 4 to 5 by @dependabot[bot] in #3060
Throw explicit InvalidImageContentException when BMP BPP is invalid. by @JimBobSquarePants in #3069
Add sparse ICC v4 mAB/mBA LUT support for ICC conversion by @JimBobSquarePants in #3070
JPEG - Throw explicit ImageContentException on missing marker. by @JimBobSquarePants in #3072
Replace AntialiasSubpixelDepth with AntialiasThreshold by @JimBobSquarePants in #3073
Add check, if Offset is greater then stream length when reading bitmap colorMapSize by @brianpopow in #3075
Bump actions/checkout from 4 to 6 by @dependabot[bot] in #3057
Add Matrix4x4 transform overloads and corresponding tests by @JimBobSquarePants in #3077
Add check for span length in parse PNG pHYs chunk by @brianpopow in #3080
Bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #3076
Add checks, if enough data is present when reading PNG text chunks by @brianpopow in #3081
PNG: Should Not Throw Exception when alpha.Length > colorTable.Length in tRNS chunk by @brianpopow in #3084
Expand pixel blender API to support single color bulk operations and fix transforms. by @JimBobSquarePants in #3089
PNG: Throw InvalidImageContentException when frame control chunk does not have enough data by @brianpopow in #3094
Add working-buffer blending and adjust row APIs by @JimBobSquarePants in #3102
Fix JPEG SIMD slicing and padding length handling. by @JimBobSquarePants in #3105
Update and simplify quantization color caches and tests by @JimBobSquarePants in #3107
Fix Identify returning incorrect frame count for animated PNGs by @andreas-eriksson in #3101
Add ImageInfo.GetPixelMemorySize; docs & tests by @JimBobSquarePants in #3108
Modernize PorterDuffFunctions with operators and add tests by @JimBobSquarePants in #3109
Allow -1 (unbounded) parallelism; validate settings by @JimBobSquarePants in #3110
Benchmark parallelization by @antonfirsov in #3111
Add more throughput benchmarks and pass Configuration where missed by @antonfirsov in #3114
Add support for OpenEXR image format by @brianpopow in #3096
Add accumulative allocation tracking to allocators by @JimBobSquarePants in #3056
JPEG : Optimize ScaledCopyTo and Block8x8F for common scale factors by @JimBobSquarePants in #3115
Replace parallel row iteration with sequential loops in Crop/Convolution Processors by @JimBobSquarePants in #3113
Enhance decoders with segment integrity handling by @JimBobSquarePants in #3119
Revert "Merge pull request #3056 from SixLabors/js/accumulative-memor… by @JimBobSquarePants in #3123
Add ImageFrame visitor; use Buffer2D Size/Bounds + Expose Subregion by @JimBobSquarePants in #3125
Add support for decoding PXR24 compressed Exr images by @brianpopow in #3124
Bump codecov/codecov-action from 5 to 6 by @dependabot[bot] in #3097
Bump NuGet/setup-nuget from 2 to 4 by @dependabot[bot] in #3121
Add additional unit tests to improve code coverage. Update licensing by @JimBobSquarePants in #3127
Fix integer overflow and bounds-checking vulnerabilities in EXR decoder by @svenclaesson in #3126
Add AllocationTrackedMemoryManager and refactor allocators by @JimBobSquarePants in #3120

New Contributors

@jscarle made their first contribution in #2623
@marklagendijk made their first contribution in #2624
@RobertMut made their first contribution in #2641
@frg2089 made their first contribution in #2579
@KirillAldashkin made their first contribution in #2780
@lofcz made their first contribution in #2781
@lassevk made their first contribution in #2787
@ardabada made their first contribution in #2740
@mistoll made their first contribution in #2819
@Socolin made their first contribution in #2748
@kasperk81 made their first contribution in #2812
@paulomorgado made their first contribution in #2905
@zabulus made their first contribution in #2911
@SladeThe made their first contribution in #2940
@brianberns made their first contribution in #2986
@waacton made their first contribution in #2987
@jrlost made their first contribution in #3036
@Yushu2606 made their first contribution in #2995
@andreas-eriksson made their first contribution in #3101

Full Changelog: SixLabors/ImageSharp@v3.1.6...v4.0.0

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2026-10-08T02:57:31Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 5b8472e4-cc65-4222-9a0c-2b232ced9393

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Update dependency SixLabors.ImageSharp to v4 [SECURITY]

6abd406

Navigation Menu

Repository navigation

Update dependency SixLabors.ImageSharp to v4 [SECURITY] - #142

Update dependency SixLabors.ImageSharp to v4 [SECURITY]#142
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/nuget-sixlabors.imagesharp-vulnerability

renovate Bot commented Oct 8, 2026

Uh oh!

coderabbitai Bot commented Oct 8, 2026

Review skipped

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 8, 2026

Release Notes

v4.1.2

What's Changed

v4.1.1

What's Changed

v4.1.0

What's Changed

New Contributors

v4.0.0

What's Changed

New Contributors

Configuration

Uh oh!

coderabbitai Bot commented Oct 8, 2026

Review skipped

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v4.1.2`

`v4.1.1`

`v4.1.0`

`v4.0.0`